4xx Client error
HTTP 401 Unauthorized
The request lacks valid authentication credentials. Despite the name, this is about authentication, not permission.
A 401 Unauthorized means the request has no valid authentication credentials. Despite the name, it's about who you are (authentication), not what you're allowed to do (that's 403).
Common causes of a 401 error
- No Authorization header, cookie, or API key was sent.
- The token or API key is wrong, revoked, or has expired.
- The credentials are in the wrong format, for example a missing "Bearer " prefix.
- The token was issued for a different environment, audience, or scope.
- A session timed out on the server.
How to fix a 401 error
- Log in again, or refresh the access token, then retry the request.
- Send the header exactly as documented, for example Authorization: Bearer <token>.
- Decode the token (a JWT decoder helps) and check its expiry (exp), issuer and audience.
- Confirm you're using the right key for the right environment: production versus test.
- Check that a proxy or redirect isn't stripping the Authorization header.
Frequently asked questions
What's the difference between 401 and 403?
401 means the server doesn't know who you are: log in or send valid credentials. 403 means it knows who you are but you don't have permission, so logging in again won't help.
Why do I get 401 even though I'm logged in?
Your session or token has probably expired, or the client isn't sending it, for example a cookie blocked on a cross-site request, or a fetch call missing credentials: "include".
Other common status codes
See 401 in the full searchable list, or use the HTTP Header Checker to see the status code any URL returns.